CVE-2024-38578

CVE Details

Release Date:

2024-06-19

Description

In the Linux kernel, the following vulnerability has been resolved:\necryptfs: Fix buffer size for tag 66 packet\nThe 'TAG 66 Packet Format' description is missing the cipher code and\nchecksum fields that are packed into the message packet. As a result,\nthe buffer allocated for the packet is 3 bytes too small and\nwrite_tag_66_packet() will write up to 3 bytes past the end of the\nbuffer.\nFix this by increasing the size of the allocation so the whole packet\nwill always fit in the buffer.\nThis fixes the below kasan slab-out-of-bounds bug:\nBUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0\nWrite of size 1 at addr ffff88800afbb2a5 by task touch/181\nCPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014\nCall Trace:\n\ndump_stack_lvl+0x4c/0x70\nprint_report+0xc5/0x610\n? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n? kasan_complete_mode_report_info+0x44/0x210\n? ecryptfs_generate_key_packet_set+0x7d6/0xde0\nkasan_report+0xc2/0x110\n? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n__asan_store1+0x62/0x80\necryptfs_generate_key_packet_set+0x7d6/0xde0\n? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10\n? __alloc_pages+0x2e2/0x540\n? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]\n? dentry_open+0x8f/0xd0\necryptfs_write_metadata+0x30a/0x550\n? __pfx_ecryptfs_write_metadata+0x10/0x10\n? ecryptfs_get_lower_file+0x6b/0x190\necryptfs_initialize_file+0x77/0x150\necryptfs_create+0x1c2/0x2f0\npath_openat+0x17cf/0x1ba0\n? __pfx_path_openat+0x10/0x10\ndo_filp_open+0x15e/0x290\n? __pfx_do_filp_open+0x10/0x10\n? __kasan_check_write+0x18/0x30\n? _raw_spin_lock+0x86/0xf0\n? __pfx__raw_spin_lock+0x10/0x10\n? __kasan_check_write+0x18/0x30\n? alloc_fd+0xf4/0x330\ndo_sys_openat2+0x122/0x160\n? __pfx_do_sys_openat2+0x10/0x10\n__x64_sys_openat+0xef/0x170\n? __pfx___x64_sys_openat+0x10/0x10\ndo_syscall_64+0x60/0xd0\nentry_SYSCALL_64_after_hwframe+0x6e/0xd8\nRIP: 0033:0x7f00a703fd67\nCode: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f\nRSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\nRAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67\nRDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c\nRBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000\nR10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941\nR13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040\n\nAllocated by task 181:\nkasan_save_stack+0x2f/0x60\nkasan_set_track+0x29/0x40\nkasan_save_alloc_info+0x25/0x40\n__kasan_kmalloc+0xc5/0xd0\n__kmalloc+0x66/0x160\necryptfs_generate_key_packet_set+0x6d2/0xde0\necryptfs_write_metadata+0x30a/0x550\necryptfs_initialize_file+0x77/0x150\necryptfs_create+0x1c2/0x2f0\npath_openat+0x17cf/0x1ba0\ndo_filp_open+0x15e/0x290\ndo_sys_openat2+0x122/0x160\n__x64_sys_openat+0xef/0x170\ndo_syscall_64+0x60/0xd0\nentry_SYSCALL_64_after_hwframe+0x6e/0xd8

See more information about CVE-2024-38578 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12581	2024-08-12
Oracle Linux version 7 (kernel-uek)	ELSA-2024-12611	2024-09-11
Oracle Linux version 7 (kernel-uek-container)	ELSA-2024-12585	2024-08-12
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12581	2024-08-12
Oracle Linux version 8 (kernel-uek-container)	ELSA-2024-12584	2024-08-12